This is all amateur hour shenanigans.
For something like muse that's supposed to be a general-purpose assistant, how do you give it enough access to be useful, without giving it too much access, and creating unacceptable risks? And how do you do that in a way that's comprehensible the average Facebook user who's the target market of this product?
When you're a company running around with more than a few billion in the vault, you have no excuse for the level security negligence going on at every phase of rollout.
I gawked at Cursor executing a python script one time and decided enough was enough, I don't raw dog these tools anymore because their developers are the dumbest people to task with security work. They just don't care.
What features you want it to have? The thing you're saying is super vague, I would just say that one belongs in cloud.
If it must run things on the user's machine, it's gotta be in a rootless container and not be root inside the container. All tools belong in the container. Folder access explicitly configured by the user.
Like I already did this for my local AI: https://github.com/SamInTheShell/loom
It's not perfect or even done, but it works and it shows the security model that should be standard for aligned models we're running.
Unaligned models, absolutely different story.
Also VM is better than container for security, but containers are a bare minimum for me.
Nether service has a way to configure fine-grained access for a secondary user.
How do I go about giving the agent the ability to perform these tasks without exposing myself to the risk of unexpected destructive behavior from the agent?
If you want to design a system specifically to make sure you're not going to get stonewalled for sending me an emdash, you build and maintain a set of permissive rules for sending/reading to avoid my blacklist of people I'll never work with.
Once you got API stuff sorted, just throw a cronjob at it or build a service for that stuff.
^ There be prompts all over the place here, obviously. Realistically your MCP server will end up hacking on POP3.
Meta rushed this out, to grab relevancy, especially after losing out to Sam with OpenClaw.
I just dont fundamentally trust such a blackbox with my data. They've literally turned your data and your life into their biggest asset. For it to now have a level of control in your life just seems... irresponsible.